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DETAILED ACTION 

1. Claims 1-16 are pending and have been examined. The priority date considered for the 
apphcation is May 8, 2000. 

Double Patenting 

2. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent possible 
harassment by multiple assignees. See In re Goodman, 1 1 F.3d 1046, 29 USPQ2d 2010 (Fed. 
Cir. 1993); In re LongU 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Omum, 686 
F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, All F.2d 438, 164 USPQ 619 (CCPA 
1970); and, In re Thorington^ 418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) may be used to 
overcome an actual or provisional rejection based on a nonstatutory double patenting ground 
provided the conflicting application or patent is shown to be commonly owned with this 
application. See 37 CFR 1. 130(b). 

Effective January 1 , 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 
CFR 3.73(b). 

3. Claims 1-16 are provisionally rejected under the judicially created doctrine of 
obviousness-type double patenting as being unpatentable over claim 1-23 of copending 
Application No. 09/809,499. Although the conflicting claims are not identical, they are not 
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patentably distinct from each other because they both recite analogous methods, systems and 
apparatuses for extracting a verification model from source code and for verifying the model 
with a model checker. 

For example, claim 1 of both appKcations recites defining a control flow, generating 
source strings, using mapping or conversion rules to translate the source strings to a target 
language, and generating a verification model according to the control flow and the translation. 
Claim 1 1 of the instant application and claim 20 of App. No. 09/809,499 additionally recite a 
model checker for checking the model according to a property or properties. 

This is a provisional obviousness-type double patenting rejection because the conflicting 
claims have not in fact been patented. 

4. Claims 1-16 are rejected under the judicially created doctrine of obviousness-type double 
patenting as being unpatentable over claims 1-23 of U.S. Patent No. 6,353,896. Although the 
conflicting claims are not identical, they are not patentably distinct from each other because they 
both recite analogous methods, systems and apparatuses for extracting a verification model from 
source code and for verifying the model with a model checker. 

For example, claim 1 of the instant application and claims 1-3 of the patent recite using a 
translation map or mapping rules to convert the source code to a model for verification. Claims 
1 1 and 12 of the instant application additionally recite checking the model with a SPIN model 
checker, as recited in claims 5 and 6 of the patent. 
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Claim Rejections - 35 USC § 103 

5, The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. Pat. No. 
6,625,797 to Edwards et al. (hereinafter "Edwards") in view of U.S. Pat. No. 5,615,137 to 
Holzmann et al. (hereinafter "Holzmann"). 

With respect to claim 1, Edwards discloses a method for extracting a verification model 
from source code (see the abstract and FIG. 1) comprising the steps of: 

defining a control flow for procedures in the source code (see column 3, lines 36-39, 
which shows defining control flow paths for fimctions or procedures in the source code); 

generating source strings for selected elements of the source code (see column 6, lines 4- 
14, which shows generating sequences of source bytecodes, i.e. source strings); 

associating the source strings to an interpretation according to a plurality of prioritized 
mapping rules (see column 6, Hues 15-25, which shows associating the source bytecodes or 
strings with nodes of a flow graph based on a specification, and column 3, lines 22-35, which 
further shows annotating the nodes with mapping rules for the implementation); 
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applying the associated interpretation to the source strings to translate the source strings 
to strings of a target language (see column 5, lines 39-44, which shows applying the flow graph 
representation to translate the source code to a target language); 

generating the verification model in the target language, the generating step including the 
step of populating the control flow with the strings of the target language, wherein the 
verification model conforms to the control flow (see column 6, lines 26-42, which shows 
generating the implementation or model based on the flow graph, and column 5, line 62 to 
column 6, hne 2, which shows populating the graph with the nodes and control flow paths). 

Although Edwards discloses optimizing the model with techniques such as logic 
reduction (see column 8, lines 42-54), Edwards does not expressly disclose the step of 

optimizing the verification model according to a property to be verified. 

However, Holzmann discloses a system for optimizing a model with state space reduction 
according to properties to be verified (see the abstract and column 2, lines 15-23), for the 
purpose of verifying, for example, a control system design (see column 1, lines 16-35). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to supplement the optimizations disclosed by Edwards with those taught by 
Holzmann, for the purpose of verifying the correctness of the model according to a property. 

With respect to claim 2, Edwards further discloses the limitation wherein the plurality of 
mapping rules comprises at least one explicit mapping (see column 9, lines 21-25 and column 
18, lines 11-16, which show examples of explicit mappings). 
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With respect to claim 3, Edwards further discloses the limitation wherein the plurality of 
mapping rules comprises at least one data restriction (see column 10, lines 46-57, which shows a 
data restriction based on data type precision). 

With respect to claim 4, Edwards further discloses the hmitation wherein the plurality of 
mapping rules comprises at least one default type rule (see column 10, lines 35-46, which shows 
defaulting to the maximum data type precision). 

With respect to claim 5, Edwards further discloses the hmitation wherein the plurality of 
mapping rules comprises at least one explicit mapping, at least one data restriction and at least 
one default type rule (see column 9, lines 21-25 and column 18, lines 11-16, which show 
examples of exphcit mappings; see also column 10, lines 46-57, which shows a data restriction 
based on datatype precision; see also column 10, lines 35-46, which shows defaulting to the 
maximum data type precision). 

With respect to claim 6, Edwards further discloses the limitation wherein associating the 
source strings to an interpretation according to a plurality of prioritized mapping rules comprises 
the further steps of, for each source string: 

(a) searching a lookup table for an explicit mapping that matches the source string (see 
column 9, lines 21-25 and column 18, lines 11-16, which show examples of explicit mappings 
that match portions of the source code; note that a lookup table or some other analogous data 
structure is inherently searched for such mappings); 

(b) if a matching explicit mapping is found in step (a), associating the source string to the 
interpretation corresponding to the expHcit mapping (see column 6, lines 15-25, which shows 
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associating the source bytecodes or strings with nodes representing the target implementation, 
i.e. corresponding to the explicit mappings); 

(c) if no matching explicit mapping is found in step (a), determining if a data restriction 
appHes to the source string (see column 10, lines 26-32, which shows determining a data 
restriction, e.g. precision, when there is no explicit definition or mapping); 

(d) if a single applicable data restriction is determined in step (c), associating the source 
string to the interpretation corresponding to the single applicable data restriction (see column 1 0, 
lines 46-57, which shows applying the data restriction to the nodes from the source code); 

(e) if a plurality of applicable data restrictions are determined in step (c), selecting one of 
the applicable data restrictions and associating the source string to the interpretation 
corresponding to the selected data restriction (see column 10, line 58 to column 11, line 7, which 
shows selecting and applying one data restriction from a plurality of data restrictions); 

(f) if no apphcable data restriction is found in step (c), associating the source string to the 
interpretation according to a default type rule (see column 10, lines 35-46, which shows applying 
a default datatype rule, e.g. precision, when a data restriction has not been found). 

With respect to claim 7, Edwards further discloses the limitation wherein the lookup table 
contains source string patterns representing a plurality of entries in the lookup table, wherein 
searching the lookup table includes searching for the source string patterns (see column 10, lines 
9-14, which shows detecting keywords in the source code, i.e. source string patterns, to identify a 
mapping to the target implementation). 
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With respect to claim 8, Edwards further discloses the limitation wherein the application 
of the mapping rules causes the translating of the source strings to respective equivalent 
statements in the target language when the selected source code elements are fully relevant to a 
property to be tested and the translating of the source strings to nul statements in the target 
language when the selected source code elements are irrelevant to the property to be tested (see 
column 8, line 56 to column 9, line 10, which shows reducing the flow graph so that only those 
source code elements relevant to the target implementation will be translated; note that because 
null statements are analogous to no-op statements, it would have been obvious to one of ordinary 
skill in the art at the time the invention was made to translate the irrelevant source code elements 
to null or no-op statements rather than not including them in the model). 

With respect to claim 9, Edwards further discloses the limitation wherein the source code 
is selected from the group comprising C, C++, and Java (see column 6, lines 4-14, which shows 
that the source code may be written in the C, C++ or Java languages). 

7, Claims 10-12, 15 and 16 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Holzmann in view of Edwards. 

With respect to claim 10, Holzmann discloses, in a computer-based model checker, a 
method for automatically verifying a property of a system using the system source code, the 
model checker operable to check a verification model for the property (see column 3, lines 38- 
64, which shows a model checker for verifying a property of a system). 

Although Holzmann discloses modeling a system for verification (see the abstract) and 
inputting both the system description, i.e. the verification model, and a representation of the 
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property to the model checker (see column 3, lines 38-64), Holzmann does not expressly disclose 
additional steps recited in the claim. 

However, Edwards discloses a method for extracting a model of a system (see the 
abstract and FIG. 1) comprising the steps of 

inputting the source code, a conversion table, a representation of the property and an 
optional preferences file to the apparatus, the conversion table including strings corresponding to 
strings of the source code and interpretations mapped to the strings, the preferences file including 
interpretations for overriding default rule interpretations (see column 6, lines 4-14, which shows 
inputting the source code, and column 3, lines 22-35, which shows inputting annotations or 
preferences for overriding default implementations; see also column 9, lines 21-25 and column 
18, lines 11-16, which show examples of conversions corresponding to portions of the source 
code to mapped to implementations; note that a conversion table or some other analogous data 
structure is inherently provided for such conversions); 

programming the model checker with default rule interpretations, wherein the default rule 
interpretations when applied by the model checker translate source code strings to a language of 
the model checker (see column 6, lines 15-25, which shows generating a flow graph 
representation based on a specification, i,e, default rules, and column 5, lines 39-44, which 
shows applying the representation to translate the source code to a target language); 

defining a control flow for each procedure in the source code (see column 3, lines 36-39, 
which shows defining control flow paths for functions or procedures in the source code); 
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selecting source code strings for translation from the source code to the language of the 
model checker (see column 6, lines 4-14, which shows selecting source code sequences or strings 
for translation); 

for each selected string, according to a predetermined priority: 

searching the conversion table for entries corresponding to the selected string (see 
column 9, lines 21-25 and column 18, lines 11-16, which show examples of conversions 
corresponding to portions of the source code; note that a conversion table or some other 
analogous data structure is inherently searched for such entries); 

translating the selected string according to the interpretation mapped to the 
selected string (see column 6, lines 15-25, which shows translating the source code to a 
corresponding flow graph having nodes mapped to the source sequence or string); 

applying the default rule interpretation corresponding to the selected string (see 
column 6, lines 15-25, which shows applying a specification, i.e. default rules); and 

overriding the default rule interpretation according to an entry in the preferences 
file (see column 6, lines 26-24, which shows applying constraints and preferences to 
override the default rules); 

populating the control flow with the interpretations to provide the verification model (see 
column 6, lines 26-42, which shows generating the implementation or model based on the flow 
graph, and column 5, Hne 62 to column 6, line 2, which shows populating the graph with the 
nodes and control flow paths). 

Holzmann further discloses the step of 
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checking the verification model for the property (see column 3, Hnes 38-64, which shows 
checking the system description, i.e. the verification model, for the property). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to use the model extraction features taught by Edwards in the model checking system 
of Holzmann, for the purpose of automatically generating a model of a system with which to 
optimize and verify the design (see Edwards, column 1, line 62 to column 2, line 2, and 
Holzmann, column 1, lines 16-35). 

With respect to claim 11, Holzmann discloses a computer-based model checker (see 
column 3, lines 38-64) comprising: 

a processor for executing instructions (note that a processor is inherently used to execute 
instructions in the model checking system); 

storage accessible to the processor for storing the instructions, a lookup table, default 
rules, source code of a system, a property to be verified and an optional preferences file (note 
that storage is inherently accessible to the processor in the model checking system). 

Although Holzmann discloses modeling a system for verification (see the abstract) and 
providing a property to be verified (see column 3, lines 38-64), Holzmann does not expressly 
disclose additional features recited in the claim. 

However, Edwards discloses a system for extracting a model of a system (see the abstract 
and FIG. 1) comprising program code or instructions (see column 21, lines 30-34), the 
instructions causing the processor to: 

parse the source code and to define a control flow for procedures in the source 

code (see column 4, lines 40-45, which shows parsing the source code, and column 3, 
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lines 36-39, which shows defining control flow paths for functions or procedures in the 
source code); 

generate source strings for selected source code elements (see column 6, lines 4- 
14, which shows generating source code sequences or strings); 

selectively associate the source strings to an interpretation according to a plurality 
of mapping rules, including mapping rules defined in the lookup table, in the default rules 
and in the optional preferences file (see column 6, lines 15-25, which shows associating 
the source strings with nodes of a flow graph according to a specification, i.e. default 
rules, and column 3, lines 22-35, which shows annotations or preferences applied to the 
association; see also column 9, lines 21-25 and column 18, lines 11-16, which show 
examples of mapping rules; note that a lookup table or some other analogous data 
structure is inherently defined for such mappings); 

apply the associated interpretation to the source strings to translate the source 
strings to strings which can be operated on by the model checker (see column 5, lines 39- 
44, which shows applying the flow graph to translate the source code to a target 
language); 

populate the control flow with the strings, the populated control flow being a 
verification model (see column 6, lines 26-42, which shows generating the 
implementation or model based on the flow graph, and column 5, line 62 to column 6, 
line 2, which shows populating the graph with the nodes and control flow paths). 
Holzmann further discloses causing the processor to: 
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check the verification model for the property (see column 3, lines 38-64, which 
shows checking the system description, i.e. the verification model, for the property); and 
an output device responsive to the processor for providing a result of the check (see 
column 3, lines 38-64, which shows outputting a result of the check; note that an output device is 
inherently used to provide the output). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to use the model extraction features taught by Edwards in the model checking system 
of Holzmann, for the purpose of automatically generating a model of a system with which to 
optimize and verify the design (see Edwards, column 1, line 62 to column 2, line 2, and 
Holzmann, column 1, lines 16-35), 

With respect to claim 12, Holzmann further discloses the limitation wherein the model 
checker is a SPIN model checker (see column 3, lines 50-52, which shows a SPIN model 
checker). 

With respect to claim 15, Holzmann in view of Edwards fiirther discloses the limitation 
wherein the lookup table includes entries corresponding to branch conditions (see Edwards, 
column 12, line 61 to column 13, line 12, which shows conditional branches and thread branches 
applied to the flow graph). 

With respect to claim 16, Holzmann in view of Edwards further discloses the limitation 
wherein the entries corresponding to branch conditions include entries for introducing a 
nondeterministic choice to the verification model (see Edwards, column 12, line 61 to column 
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13, line 12, which shows that the thread branches provide multiple control flow outputs without 
input data, introducing a nondeterministic choice). 

8. Claims 13 and 14 are rejected under 35 U.S. C. 103(a) as being unpatentable over 
Holzmann in view of Edwards as appUed to claim 1 1 above, and further in view of U.S. Pat. No. 
6,389,385 to King. 

With respect to claim 13, Holzmann in view of Edwards does not expressly disclose the 
limitation wherein the interpretations comprise print, hide, comment and keep, wherein print 
embeds the source string into a print action of the model checker, hide excludes the source string 
from representation in the verification model, comment includes the source string in the 
verification model as a comment, and keep preserves the source string in the verification model. 

However, King discloses a system for translating source code using a mapping table (see 
the abstract and block 74 in FIG. 2), wherein source characters or strings are translated and 
printed to the model, replaced with markers and excluded from the model, or included and 
preserved as comments (see FIG. 2 and column 3, lines 10-31). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to supplement the model checking and extraction system of Holzmann and Edwards 
with print, hide, comment and keep interpretations having the functionality taught by King, for 
the purpose of enabling safe and reversible translations (see King, column 1, line 66 to column 2, 
line 4) of source code to verification models. 

With respect to claim 14, Holzmann in view of Edwards in view of King further discloses 
the limitation wherein the keep preserves the source string in the verification model subject to 
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global substitute rules (see King, FIG, 2 and column 3, lines 10-31, which shows checking the 
mapping table, i.e. for global substitute rules, to determine whether to preserve the source 
characters or strings). 

9. Furthermore, the Examiner would like to direct AppUcant's attention to "Software Model 
Checking: Extracting Verification Models from Source Code" (art of record) and "A Practical 
Method for Verifying Event-Driven Software" (also art of record), which disclose features of the 
invention substantially as recited in the claims. 

For example, "Software Model Checking. . discloses a method for extracting a 
verification model from software (see page 3, top), including the control flow (see page 4), using 
a lookup table (see page 5), and verifying a property with the SPIN model checker (see page 10, 
bottom). Likewise, "A Practical Method. . discloses extracting a verification model from 
source code (see section 3) based on mappings, restrictions, and properties to be verified by the 
SPIN model checker (see section 4). 

Conclusion 

10. The prior art made of record and not reUed upon is considered pertinent to apphcant's 
disclosure. U.S. Pat. No. 6,523,172 to Martinez-Guerra et al. discloses a parser and translator for 
translating data from one format to another based on user-specified test and transformation 
statements. U.S. Pat. No. 6,182,268 to McElvain discloses a method for extracting a finite state 
machine model from a high level design. U.S. Pat. No. 6,289,502 to Garland et al. discloses a 
method for model-based software design and validation. U.S. Pat. No. 6,343,376 to Saxe et al. 
discloses a method for verifying and optimizing a program based on rules or properties. 
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1 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Yigdall whose telephone number is (703) 305-0352. 
The examiner can normally be reached on Monday through Friday from 7:30am to 4:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tuan Q. Dam can be reached on (703) 305-4552. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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